FreshTomato OS command injection vulnerability

CVE ID

CVE-2023-3991

Description

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

Tested Versions

FreshTomato 2023.3

Details

FreshTomato is an alternative open source firmware for Broadcom based routers.

Timeline

  • 2023-06-26 - Disclosure
  • 2021-07-09 - Patched

Credit

Discovered by Eugene Lim.